Training type · RANGE
Cyber range training: what it trains and which platforms sell one
Short answer
A cyber range puts a SOC or incident response team into a realistic environment under a live simulated attack, so they practise detection and response together on real tools. It is the training type closest to a real incident for technical staff. It does not train executives, legal or communications on their own decisions.
By The Range Desk · Cyber Range Compare · Published 2026-10-11 · Updated 2026-10-13
Desk research from public vendor, standards and regulator pages read on 27 September, 11 October and 13 October 2026. Profiles follow our published method; we did not run the products.
What does it train?
A range trains a team to work an attack as it unfolds: spotting the first signal, triaging alerts, investigating across tools, containing the threat and handing over cleanly. The value over a lab is the team dimension and the tooling. Analysts have to coordinate, share findings and make calls with incomplete data, on consoles that look like the ones they use at work. Some platforms run the attack against the customer's own stack, or on a replica of the customer's network, so the team practises on its own detections rather than on a generic environment.
Who should take part?
SOC analysts, threat hunters, incident responders and the engineers who own detection content. A shift lead or incident commander should take part, because the range is where handovers and escalation paths get tested under pressure. Executives rarely belong in the range itself; on some platforms a linked crisis exercise brings them in when the technical team escalates.
What does a session look like?
A team exercise usually runs from a couple of hours to a full day, scheduled in advance, with an attack scenario that develops while the team works. Platforms differ in how much is pre-built. Cyberbit lists 100+ team exercises on its range; Immersive Labs describes a range that attacks the customer's own tools; Cloud Range describes a customised replica of the customer's network with licensed versions of real SOC tools, across IT, OT/ICS, cloud and hybrid environments. Expect preparation time for accounts, tool access and scheduling, and a debrief at the end.
What should it leave behind?
A record of what the team detected, when, and what it missed; how long containment took; and which detections or playbook steps failed. Some platforms add scores or readiness measures across teams and over time. The useful output is a short list of detection and process fixes with owners, and a date for the next run to see whether they worked.
Which platforms sell it?
| Platform | Status | What their pages describe | Source |
|---|---|---|---|
| Reflex Security | Not in our sources | Not described on the pages we read. | None |
| BreachRx | Not in our sources | Not described on the pages we read. | None |
| Cloud Range | Sold | Live-fire attack simulations across IT, OT/ICS, cloud and hybrid environments, on a customised replica of your network with licensed versions of real SOC tools. | Source: Cloud Range homepage · Read 11 Oct 2026 |
| Conducttr | Not in our sources | Not described on the pages we read. | None |
| Cyberbit | Sold | Cyberbit Readiness is a cloud-based cyber range with 100+ team exercises. | Source: Cyberbit homepage · Read 27 Sep 2026 |
| Cytactic | Not in our sources | Not described on the pages we read. | None |
| Hack The Box | Sold with a condition | HTB PRO, an individual plan announced in September 2026, lists SOC Range access from Q4 2026; a team range on your own tools is not described on the pages we read. | Source: Hack The Box blog: HTB PRO plan announcement · Read 27 Sep 2026 |
| iluminr | Not in our sources | Not described on the pages we read. | None |
| Immersive Labs | Sold | Dynamic Threat Range runs live-fire attacks on the customer's own stack, with tools such as Microsoft Sentinel, Elastic, Splunk and CrowdStrike. | Source: Immersive Labs: cybersecurity technical exercises · Read 27 Sep 2026 |
| KnowBe4 | Not in our sources | Not described on the pages we read. | None |
| SimSpace | Sold | "Bring your team, your tools, or your AI agents. We'll build the environment, run the attack, and show you the results." | Source: SimSpace homepage · Read 11 Oct 2026 |
| TryHackMe | Sold with a condition | SOC Simulator, Threat Hunting Simulator and Live Breach Exercises are listed for business teams; a range on your own tools is not described on the pages we read. | Source: TryHackMe for business · Read 27 Sep 2026 |
6 of 12 platforms sell it; 2 sell it with a condition; 6 are not in our sources.
When is it the wrong choice?
When the gap is not technical. If your last incident went wrong because nobody knew who could approve taking a system offline, or because legal and communications were brought in late, a range will not fix it: that is a decision and coordination problem, and tabletop or crisis simulation trains it. A range is also more than a new analyst needs on day one; individual labs build the basics first.
What does it cost, and what do platforms publish?
Among the platforms here that sell a team range, none publishes its price, so expect a quote after a sales conversation.
Cloud RangeNot published
Not published on the homepage; the route in is a demo request.
Source: Cloud Range homepage · Read 11 Oct 2026
CyberbitNot published
Not published. The cyberbit.com/pricing address returned a 404 when we read it.
Source: cyberbit.com/pricing (returned 404) · Read 27 Sep 2026
Professional: $250 per seat per month or $2,500 per seat per year. Lite, Base and Ultimate are not priced publicly; Lite lists a 14-day free trial. Crisis Control: price not published.
Source: Hack The Box business pricing · Read 27 Sep 2026
Immersive LabsNot published
Not published.
Source: Immersive Labs homepage · Read 27 Sep 2026
SimSpaceNot published
Not published; the route in is a discovery call.
Source: SimSpace homepage · Read 11 Oct 2026
Business: Foundation $99 per month and Advanced $199 per month; Enterprise on request. Whether these prices are per user, and the billing period, were not confirmed in our read, so check before budgeting. A free individual tier and paid individual plans are also published.
Source: TryHackMe business pricing · Read 11 Oct 2026
Questions people ask
Is a cyber range the same as a penetration testing lab?
No. A penetration testing lab trains attackers to find and exploit weaknesses. A cyber range, as the term is used for team training, usually puts defenders against a simulated attack so they practise detection and response. Some platforms offer both.
Do we need our own tools in the range?
Not necessarily, but it changes what you learn. A range built on generic tools teaches method; one that runs against your own stack also tests your actual detections. Immersive Labs describes the second, Cloud Range builds a replica of your network with licensed versions of real SOC tools, and SimSpace invites teams to bring their own tools; Cyberbit's exercises use commercial tools from vendors such as CrowdStrike, Splunk and Microsoft.
How often should a SOC run range exercises?
Often enough that fixes from the last exercise can be tested in the next one. The right cadence depends on staff turnover and how quickly your detections change; individual labs can fill the gaps between team exercises.
Read next
- Hands-on lab libraries
One person works through a guided technical task in a browser lab, picked from a library of hundreds or thousands.
- Tabletop and crisis simulation
The people who own decisions in an incident work through a scenario and decide what to do, from a scripted discussion to an adaptive simulation.
- Awareness training
Short modules and simulated phishing that teach every employee to spot and report threats.
- Training type finder
Five questions that weigh the four types for your team.
- Cloud Range beside Cyberbit
A pair that sells this type, fact by fact.